Low-Code Development Platforms (LCDPs) are gaining more and more traction, even in the industrial context, as a means for anyone with less coding experience to develop and deploy applications. However, little is known about the vulnerabilities resulting from this new software development model. This paper aims to understand vulnerabilities in applications developed and deployed on these platforms. We show that these vulnerabilities can be considered from three perspectives: platform, developer, and plugins. We determine the top three vulnerabilities for each perspective based on a review of the literature and expert interviews. Our results contribute to understanding LCDP applications’ security and raise awareness of industry practitioners by providing typical LCDP security pitfalls.

Miguel Lourenço and Maria Pinto-Albuquerque thank the Instituto Universitário de Lisboa and ISTAR for their support. Siemens acknowledges funding for project CONTAIN bythe Federal Ministry of Education and Research under project number 13N16585.

Low code,Software development,Web applications,Cybersecurity,Industry,Low code development platforms,Vulnerabilities

Best Paper Award

This publication is an output of the following project(s):

• Alternative Shaper
• Impact of Blockchains and Decentralised Ledger Technologies